gencow 0.1.188 → 0.1.189

package/lib/cli-project-runtime.mjs

@@ -595,7 +595,7 @@ export function findServerRoot(options = {}) {
   const siblingServer = resolvePathImpl(dirnameValue, "../../server");
   if (existsSyncImpl(siblingServer)) return siblingServer;
 
-  errorImpl("Server runtime not found. Run 'bun install'.");
+  errorImpl("Server runtime not found. Run 'pnpm install'.");
   exitImpl(1);
   return null;
 }

package/lib/db-migration-command-steps.mjs

@@ -180,9 +180,22 @@ export function emitCloudMigrationSuccess({
           ? "Migration state inspection completed; the plan is ready."
           : "Migration state inspection completed; the plan remains blocked.",
       );
-      deps.logImpl(
-        `  ${DIM}Code: ${checkData.inspection.code} · Next: ${checkData.inspection.nextAction} · Database unchanged${RESET}\n`,
-      );
+      deps.logImpl(`  ${DIM}Database unchanged${RESET}\n`);
+      const plan = checkData.inspection.plan;
+      if (
+        ready &&
+        plan?.safeToRewritePending === true &&
+        Array.isArray(plan.pendingMigrationNames) &&
+        plan.pendingMigrationNames.length > 0
+      ) {
+        deps.logImpl(`  Applied migrations: ${plan.appliedVerifiedCount} (keep unchanged)`);
+        deps.logImpl("  Pending migrations that may be regenerated:");
+        plan.pendingMigrationNames.forEach((name) => deps.logImpl(`    - ${name}`));
+        deps.logImpl("  Next: back up or commit the project, then remove only the listed pending folders.");
+        deps.logImpl("        gencow db:generate");
+        deps.logImpl("        pnpm exec drizzle-kit check");
+        deps.logImpl(`        gencow db:check${environment === "prod" ? " --prod" : ""}`);
+      }
       return;
     }
     deps.successImpl("Migration plan is safe to proceed.");

package/lib/db-push-command.mjs

@@ -110,6 +110,21 @@ function extractReadOnlyMigrationInspection(data) {
     return null;
   }
   const plan = inspection.plan;
+  const pendingMigrationNames = plan?.pendingMigrationNames;
+  const hasSafePendingTail =
+    plan?.safeToRewritePending === true &&
+    Array.isArray(pendingMigrationNames) &&
+    pendingMigrationNames.length === plan?.pendingCount &&
+    pendingMigrationNames.length > 0 &&
+    new Set(pendingMigrationNames).size === pendingMigrationNames.length &&
+    pendingMigrationNames.every(
+      (name) =>
+        typeof name === "string" &&
+        name.length <= 200 &&
+        name !== "." &&
+        name !== ".." &&
+        !/[\\/\u0000-\u001f\u007f]/u.test(name),
+    );
   if (
     inspection.outcome === "READY" &&
     !(
@@ -135,6 +150,9 @@ function extractReadOnlyMigrationInspection(data) {
             planId: plan.planId,
             appliedVerifiedCount: plan.appliedVerifiedCount,
             pendingCount: plan.pendingCount,
+            ...(hasSafePendingTail
+              ? { pendingMigrationNames: [...pendingMigrationNames], safeToRewritePending: true }
+              : {}),
             ...(plan.databaseBootstrapRequired === true ? { databaseBootstrapRequired: true } : {}),
             ...(plan.migrationStorePreparationRequired === true
               ? { migrationStorePreparationRequired: true }

package/lib/deploy-auditor.mjs

@@ -2,7 +2,7 @@
  * Deploy Auditor — Pre-deploy dependency analysis (informational).
  *
  * Detects user third-party dependencies that need auto-install on the
- * Gencow cloud runtime. User deps are installed via `bun install` on
+ * Gencow cloud runtime. User deps are installed via frozen `pnpm install` on
  * the server during provisioning.
  *
  * How it works:

package/lib/deploy-dependency-compat.mjs

@@ -78,7 +78,7 @@ export function formatDependencyVersionAuditError(result) {
 
   lines.push("");
   lines.push("  Fix:");
-  lines.push(`    bun add ${installTargets.join(" ")}`);
+  lines.push(`    pnpm add ${installTargets.join(" ")}`);
   lines.push("    bunx gencow@latest deploy");
   lines.push("");
 

package/lib/deploy-failure-diagnostic.mjs

@@ -15,7 +15,8 @@ const DEPLOY_FAILURE_STAGES = new Set([
 const RETRY_CLASSES = new Set(["terminal-client", "retryable-infra", "platform-action"]);
 const USER_ACTIONS = new Set([...MIGRATION_NEXT_ACTION_KINDS, "OPERATOR_ACTION"]);
 const STRUCTURED_CONTRACT_FIELDS = ["code", "stage", "retryClass", "userAction", "correlationId"];
-const PLATFORM_ACTION_REQUIRED_MESSAGE = "Platform action is required before retrying";
+const PLATFORM_RECOVERY_MESSAGE =
+  "Gencow is recovering this deployment. Your app files do not need changes.";
 
 function safeText(value, maxLength) {
   if (typeof value !== "string") return null;
@@ -49,6 +50,7 @@ function readDeployFailureContract(value) {
   return {
     code,
     stage,
+    retryClass,
     userAction: userAction === "CONTACT_SUPPORT" ? "OPERATOR_ACTION" : userAction,
     correlationId,
     legacySupportAction: userAction === "CONTACT_SUPPORT",
@@ -57,7 +59,7 @@ function readDeployFailureContract(value) {
 
 function normalizeLegacySupportMessage(message) {
   return typeof message === "string" && /contact support/iu.test(message)
-    ? PLATFORM_ACTION_REQUIRED_MESSAGE
+    ? PLATFORM_RECOVERY_MESSAGE
     : message;
 }
 
@@ -83,8 +85,15 @@ export function renderDeployFailureDiagnosticLines(responseBody, statusText) {
     if (isLegacyCorrelationEnvelope) lines.push(correlationLine);
     return lines;
   }
+  const platformOwned = contract.retryClass === "platform-action" && contract.userAction === "OPERATOR_ACTION";
+  if (platformOwned) {
+    const lines = [`Deploy failed: ${PLATFORM_RECOVERY_MESSAGE}`];
+    const correlationLine = formatDeployCorrelationId(contract.correlationId);
+    if (correlationLine) lines.push(correlationLine);
+    return lines;
+  }
   const publicMessage = contract.legacySupportAction
-    ? PLATFORM_ACTION_REQUIRED_MESSAGE
+    ? PLATFORM_RECOVERY_MESSAGE
     : (safeText(responseBody.error, 240) ?? fallbackMessage);
   const lines = [`Deploy failed: ${publicMessage}`];
   lines.push(`Code: ${contract.code}`, `Stage: ${contract.stage}`);

package/lib/deploy-lockfile-selection.mjs

@@ -1,42 +1,78 @@
 export const DEPLOY_LOCKFILE_CANDIDATES = Object.freeze([
-  { file: "bun.lock", packageManager: "bun" },
-  { file: "bun.lockb", packageManager: "bun" },
   { file: "pnpm-lock.yaml", packageManager: "pnpm" },
-  { file: "package-lock.json", packageManager: "npm" },
 ]);
+export const UNSUPPORTED_DEPLOY_LOCKFILES = Object.freeze([
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+]);
+export const APPROVED_DEPLOY_PACKAGE_MANAGER = "pnpm@10.33.0";
 
 function declaredPackageManager(value) {
-  if (typeof value !== "string") return null;
-  return /^(bun|pnpm|npm)(?:@|$)/u.exec(value.trim())?.[1] ?? null;
+  if (typeof value !== "string") return "";
+  return value.trim();
 }
 
 export function selectDeployLockfile({ availableFiles, packageManager }) {
   const available = new Set(availableFiles);
   const detected = DEPLOY_LOCKFILE_CANDIDATES.filter(({ file }) => available.has(file));
+  const unsupportedFiles = UNSUPPORTED_DEPLOY_LOCKFILES.filter((file) => available.has(file));
   const declared = declaredPackageManager(packageManager);
-  const declaredMatch = declared ? detected.find((candidate) => candidate.packageManager === declared) : null;
+  const declaredMatch = declared === APPROVED_DEPLOY_PACKAGE_MANAGER ? detected[0] ?? null : null;
   const selected = declaredMatch ?? detected[0] ?? null;
 
   return {
     selectedFile: selected?.file ?? null,
     selectedPackageManager: selected?.packageManager ?? "none",
-    ignoredFiles: detected.filter(({ file }) => file !== selected?.file).map(({ file }) => file),
+    ignoredFiles: unsupportedFiles,
     selectionSource: declaredMatch
       ? "package.json#packageManager"
       : selected
         ? "deterministic priority"
         : "none",
+    declaredPackageManager: declared,
+    packageManagerCompliant: declared === APPROVED_DEPLOY_PACKAGE_MANAGER,
   };
 }
 
 export function detectDeployLockfile({ cwd, packageManager, existsSyncImpl, resolvePathImpl }) {
-  const availableFiles = DEPLOY_LOCKFILE_CANDIDATES.filter(({ file }) =>
+  const availableFiles = [...DEPLOY_LOCKFILE_CANDIDATES.map(({ file }) => file), ...UNSUPPORTED_DEPLOY_LOCKFILES].filter((file) =>
     existsSyncImpl(resolvePathImpl(cwd, file)),
-  ).map(({ file }) => file);
+  );
   return selectDeployLockfile({ availableFiles, packageManager });
 }
 
+export function assertCanonicalDeployLockfile(selection) {
+  if (!selection.packageManagerCompliant) {
+    const found = selection.declaredPackageManager || "missing";
+    throw new Error(
+      `package.json#packageManager must be ${APPROVED_DEPLOY_PACKAGE_MANAGER} for Gencow deploy (found: ${found}). ` +
+        `Run: pnpm import; remove ${UNSUPPORTED_DEPLOY_LOCKFILES.join(", ")}; then pnpm install --lockfile-only.`,
+    );
+  }
+  if (selection.selectedFile !== "pnpm-lock.yaml") {
+    const suffix = selection.ignoredFiles.length ? ` Found unsupported: ${selection.ignoredFiles.join(", ")}.` : "";
+    throw new Error(`pnpm-lock.yaml is required for Gencow deploy.${suffix}`);
+  }
+  return selection;
+}
+
 export function formatDeployLockfileSelectionWarning(selection) {
-  if (!selection.selectedFile || selection.ignoredFiles.length === 0) return null;
-  return `Multiple lockfiles found. Using ${selection.selectedFile} ${selection.selectionSource === "package.json#packageManager" ? "from" : "by"} ${selection.selectionSource}; ignoring ${selection.ignoredFiles.join(", ")}.`;
+  if (
+    !selection.packageManagerCompliant ||
+    selection.selectedFile !== "pnpm-lock.yaml" ||
+    selection.ignoredFiles.length === 0
+  ) {
+    return null;
+  }
+  const files = selection.ignoredFiles.join(", ");
+  return [
+    `Warning: ${files} were excluded from this deploy because this project declares ${APPROVED_DEPLOY_PACKAGE_MANAGER}.`,
+    "pnpm-lock.yaml remains the dependency authority. Remove the other lockfiles to prevent local dependency drift:",
+    "",
+    `  rm -f ${selection.ignoredFiles.join(" ")}`,
+    `  Remove-Item ${files} -ErrorAction SilentlyContinue  # PowerShell`,
+  ].join("\n");
 }

package/lib/deploy-package-claim.mjs

@@ -6,7 +6,10 @@ import { list } from "tar";
 import { MIGRATION_BUNDLE_CAPABILITY_V1 } from "@gencow/migration-contract";
 
 import { canonicalizeDeployClaimV1, createDeployRequestId, encodeDeployClaimV1 } from "./deploy-contract.mjs";
-import { DEPLOY_LOCKFILE_CANDIDATES } from "./deploy-lockfile-selection.mjs";
+import {
+  DEPLOY_LOCKFILE_CANDIDATES,
+  UNSUPPORTED_DEPLOY_LOCKFILES,
+} from "./deploy-lockfile-selection.mjs";
 
 const PACKAGE_MANIFEST = "package.json";
 const MIGRATION_MANIFEST = ".gencow/migration-bundle-manifest.json";
@@ -26,7 +29,12 @@ const CANONICAL_LEGACY_AUTH_PATTERN = new RegExp(
   `^${CANONICAL_DEPLOY_BACKEND_ROOT}/(?:auth-schema\\.(?:ts|js)|generated/auth-schema\\.(?:ts|js))$`,
   "u",
 );
-const SELECTED = new Set([PACKAGE_MANIFEST, MIGRATION_MANIFEST, ...LOCKFILES.keys()]);
+const SELECTED = new Set([
+  PACKAGE_MANIFEST,
+  MIGRATION_MANIFEST,
+  ...LOCKFILES.keys(),
+  ...UNSUPPORTED_DEPLOY_LOCKFILES,
+]);
 
 function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
@@ -89,6 +97,10 @@ export async function buildDeployClaimFromArchive({
     throw new Error("Static deploy contains a server runtime entry");
 
   const lockfiles = [...LOCKFILES].filter(([path]) => selected.has(path));
+  const unsupportedLockfiles = UNSUPPORTED_DEPLOY_LOCKFILES.filter((path) => selected.has(path));
+  if (unsupportedLockfiles.length > 0) {
+    throw new Error(`Deploy dependency lockfile is ambiguous or unsupported: ${unsupportedLockfiles.join(", ")}`);
+  }
   if (lockfiles.length > 1) throw new Error("Deploy dependency lockfile is ambiguous");
   const projectAuth = findAuthSchemaFiles(allFiles, CANONICAL_PROJECT_AUTH_PATTERN);
   const legacyAuth = findAuthSchemaFiles(allFiles, CANONICAL_LEGACY_AUTH_PATTERN);

package/lib/deploy-package-runtime.mjs

@@ -1,5 +1,5 @@
 import { execSync } from "child_process";
-import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
 import { dirname, resolve } from "path";
 import { fetchAppDiagnosticLogsViaRest, normalizeDiagnosticLogLines } from "./app-diagnostics.mjs";
 import { resolveCreatedAppResponse } from "./app-create-response.mjs";
@@ -29,7 +29,11 @@ import {
   renderMigrationDiagnosticLines,
 } from "./migration-diagnostic.mjs";
 import { emitMigrationAdvisories, emitMigrationResponsibilityNotice } from "./migration-advisory.mjs";
-import { detectDeployLockfile, formatDeployLockfileSelectionWarning } from "./deploy-lockfile-selection.mjs";
+import {
+  assertCanonicalDeployLockfile,
+  detectDeployLockfile,
+  formatDeployLockfileSelectionWarning,
+} from "./deploy-lockfile-selection.mjs";
 import { detectProjectConfigFile, warnProjectConfigSelectionOnce } from "./project-config-selection.mjs";
 import { writeCanonicalDeployBundle } from "./deploy-bundle-staging.mjs";
 async function loadProjectConfigDefault(options) {
@@ -133,7 +137,6 @@ export function createDeployPackageRuntime({
   statSyncImpl = statSync,
   successImpl = success,
   tarCreateImpl,
-  unlinkSyncImpl = unlinkSync,
   verifyAppReadyImpl,
   warnImpl = warn,
   writeCronManifestForProjectImpl,
@@ -333,7 +336,6 @@ export function createDeployPackageRuntime({
 
     infoImpl("Packaging project...");
     const tmpBundle = resolvePathImpl(cwd, ".gencow", "deploy-bundle.tar.gz");
-    const filteredPkgPath = resolvePathImpl(cwd, ".gencow", "deploy-package.json");
     mkdirSyncImpl(dirname(tmpBundle), { recursive: true });
     const projectConfig = await loadProjectConfigForDeploy({
       cwd,
@@ -379,18 +381,17 @@ export function createDeployPackageRuntime({
       return null;
     }
 
-    const lockfileSelection = detectDeployLockfile({
+    const lockfileSelection = assertCanonicalDeployLockfile(detectDeployLockfile({
       cwd,
       packageManager: projectPkg.packageManager,
       existsSyncImpl,
       resolvePathImpl,
-    });
+    }));
     const lockfileWarning = formatDeployLockfileSelectionWarning(lockfileSelection);
     if (lockfileWarning) warnImpl(lockfileWarning);
     const projectConfigSelection = detectProjectConfigFile({ cwd, existsSyncImpl, resolvePathImpl });
     warnProjectConfigSelectionOnce({ cwd, selection: projectConfigSelection, warnImpl });
 
-    let auditResult = null;
     if (!forceDeploy) {
       try {
         const { auditDeployDependencies, formatAuditError } = await (
@@ -398,7 +399,7 @@ export function createDeployPackageRuntime({
         )();
         const entryPoint = resolvePathImpl(cwd, backendRoot, "index.ts");
         if (existsSyncImpl(entryPoint)) {
-          auditResult = await auditDeployDependencies(entryPoint);
+          const auditResult = await auditDeployDependencies(entryPoint);
           const auditMessage = formatAuditError(auditResult);
           if (auditMessage) logImpl(auditMessage);
         }
@@ -407,35 +408,8 @@ export function createDeployPackageRuntime({
       }
     }
 
-    let useFilteredPkg = false;
-    if (auditResult?.runtimeDeps?.length >= 0) {
-      try {
-        const allDeps = { ...projectPkg.dependencies, ...projectPkg.devDependencies };
-        const runtimeDeps = {};
-        for (const dependency of auditResult.runtimeDeps) {
-          if (allDeps[dependency]) runtimeDeps[dependency] = allDeps[dependency];
-        }
-        writeFileSyncImpl(
-          filteredPkgPath,
-          JSON.stringify({ name: projectPkg.name || "gencow-app", dependencies: runtimeDeps }, null, 2),
-        );
-        useFilteredPkg = true;
-
-        const totalDeps = Object.keys(allDeps).length;
-        const runtimeCount = Object.keys(runtimeDeps).length;
-        if (totalDeps > runtimeCount) {
-          infoImpl(
-            `${DIM}package.json filtered: ${runtimeCount}/${totalDeps} packages will be installed on server.${RESET}`,
-          );
-        }
-      } catch {
-        useFilteredPkg = false;
-      }
-    }
-
-    const stagedPackageJson = useFilteredPkg
-      ? readFileSyncImpl(filteredPkgPath, "utf8")
-      : readFileSyncImpl(resolvePathImpl(cwd, "package.json"), "utf8");
+    // Keep the manifest byte-compatible with the canonical pnpm lock importer.
+    const stagedPackageJson = readFileSyncImpl(resolvePathImpl(cwd, "package.json"), "utf8");
 
     let bundleBackendRoot;
     try {
@@ -465,12 +439,6 @@ export function createDeployPackageRuntime({
       errorImpl(`Packaging failed: ${caught.message}`);
       exitImpl(1);
       return null;
-    } finally {
-      try {
-        if (useFilteredPkg) unlinkSyncImpl(filteredPkgPath);
-      } catch {
-        /* ignore */
-      }
     }
 
     const bundleBuffer = readFileSyncImpl(tmpBundle);
@@ -616,6 +584,7 @@ export function createDeployPackageRuntime({
       pollAcceptedDeploymentOperation({
         initialResponse,
         creds,
+        expectedAppName: appId,
         platformFetch: platformFetchImpl,
         setTimeoutImpl,
       });

package/lib/deployment-operation-poll.mjs

@@ -1,5 +1,11 @@
 import { readJsonObjectResponse } from "./http-response-json.mjs";
 
+const PENDING_STATES = new Set(["accepted", "queued", "running"]);
+const TERMINAL_STATES = new Set(["succeeded", "failed", "blocked", "cancelled"]);
+const OPERATION_ID = /^[1-9][0-9]*$/u;
+const CORRELATION_ID = /^[A-Za-z0-9_-]{8,128}$/u;
+const APP_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/u;
+
 function invalidOperationResponse(message) {
   return {
     ok: false,
@@ -15,53 +21,96 @@ function invalidOperationResponse(message) {
   };
 }
 
+function readIdentity(body) {
+  const operationId = Number(body?.operationId ?? body?.deployId);
+  return {
+    operationId,
+    correlationId: body?.correlationId,
+    appName: body?.appName,
+    pollUrl: body?.pollUrl,
+    state: body?.state,
+  };
+}
+
+function identityIsValid(identity, expected, requirePollUrl) {
+  const operationText = String(identity.operationId);
+  return Boolean(
+    Number.isSafeInteger(identity.operationId) &&
+    identity.operationId > 0 &&
+    OPERATION_ID.test(operationText) &&
+    typeof identity.correlationId === "string" &&
+    CORRELATION_ID.test(identity.correlationId) &&
+    typeof identity.appName === "string" &&
+    APP_NAME.test(identity.appName) &&
+    identity.appName === expected.appName &&
+    (expected.operationId === null || identity.operationId === expected.operationId) &&
+    (expected.correlationId === null || identity.correlationId === expected.correlationId) &&
+    (!requirePollUrl ||
+      (typeof identity.pollUrl === "string" &&
+        identity.pollUrl === `/platform/deployments/${identity.operationId}` &&
+        (expected.pollUrl === null || identity.pollUrl === expected.pollUrl))),
+  );
+}
+
+function isNonterminalResponse(response, body, identity) {
+  return (
+    response.status === 202 ||
+    (response.status === 409 &&
+      typeof body?.code === "string" &&
+      body.code.endsWith("_CONVERGENCE_PENDING") &&
+      PENDING_STATES.has(identity.state))
+  );
+}
+
 export async function pollAcceptedDeploymentOperation({
   initialResponse,
   creds,
+  expectedAppName,
   platformFetch,
   setTimeoutImpl,
 }) {
+  const expected = {
+    operationId: null,
+    correlationId: null,
+    pollUrl: null,
+    appName: expectedAppName,
+  };
+  if (typeof expected.appName !== "string" || !APP_NAME.test(expected.appName)) {
+    return invalidOperationResponse("Deployment operation app identity is invalid");
+  }
   let response = initialResponse;
-  let expectedOperationId = null;
-  let expectedPollUrl = null;
-  for (let attempt = 0; attempt < 900 && response.status === 202; attempt += 1) {
-    const accepted = await readJsonObjectResponse(response);
-    const pollUrl = accepted?.pollUrl;
-    const operationId = Number(accepted?.operationId);
+  for (let attempt = 0; attempt < 900; attempt += 1) {
+    const body = await readJsonObjectResponse(response);
+    const identity = readIdentity(body);
+    const nonterminal = isNonterminalResponse(response, body, identity);
+    if (nonterminal) {
+      if (!PENDING_STATES.has(identity.state) || !identityIsValid(identity, expected, true)) {
+        return invalidOperationResponse("Platform returned an invalid deployment operation");
+      }
+      expected.operationId ??= identity.operationId;
+      expected.correlationId ??= identity.correlationId;
+      expected.pollUrl ??= identity.pollUrl;
+      const retryAfter = Number(response.headers?.get?.("Retry-After"));
+      const retryDelayMs =
+        Number.isFinite(retryAfter) && retryAfter >= 1 && retryAfter <= 10 ? retryAfter * 1000 : 1000;
+      await new Promise((resolveDelay) => setTimeoutImpl(resolveDelay, retryDelayMs));
+      response = await platformFetch(creds, expected.pollUrl, { method: "GET" });
+      continue;
+    }
     if (
-      typeof pollUrl !== "string" ||
-      !/^\/platform\/deployments\/[1-9][0-9]*$/u.test(pollUrl) ||
-      !Number.isSafeInteger(operationId) ||
-      operationId <= 0 ||
-      pollUrl !== `/platform/deployments/${operationId}` ||
-      (expectedOperationId !== null && operationId !== expectedOperationId) ||
-      (expectedPollUrl !== null && pollUrl !== expectedPollUrl)
+      expected.operationId === null ||
+      !TERMINAL_STATES.has(identity.state) ||
+      !identityIsValid(identity, expected, false)
     ) {
-      return invalidOperationResponse("Platform returned an invalid deployment operation");
-    }
-    expectedOperationId ??= operationId;
-    expectedPollUrl ??= pollUrl;
-    const retryAfter = Number(response.headers?.get?.("Retry-After"));
-    const retryDelayMs =
-      Number.isFinite(retryAfter) && retryAfter >= 1 && retryAfter <= 10 ? retryAfter * 1000 : 1000;
-    await new Promise((resolveDelay) => setTimeoutImpl(resolveDelay, retryDelayMs));
-    response = await platformFetch(creds, pollUrl, { method: "GET" });
-  }
-  if (response.status !== 202) {
-    if (expectedOperationId !== null) {
-      const terminal = await readJsonObjectResponse(response);
-      if (Number(terminal?.operationId ?? terminal?.deployId) !== expectedOperationId) {
-        return invalidOperationResponse("Platform changed deployment operation identity");
-      }
-      return {
-        ok: response.ok,
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers,
-        json: async () => terminal,
-      };
+      return invalidOperationResponse("Platform changed deployment operation identity or state");
     }
-    return response;
+    return {
+      ok: response.ok,
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers,
+      json: async () => body,
+    };
   }
   return {
     ok: false,

package/lib/dev-cloud-bundle.mjs

@@ -14,7 +14,11 @@ import {
 } from "./deploy-auditor.mjs";
 import { shouldIncludeTarEntry } from "./tar-archive.mjs";
 import { verifyMigrationBundleArchiveRoundTrip } from "./migration-bundle-roundtrip.mjs";
-import { detectDeployLockfile, formatDeployLockfileSelectionWarning } from "./deploy-lockfile-selection.mjs";
+import {
+  assertCanonicalDeployLockfile,
+  detectDeployLockfile,
+  formatDeployLockfileSelectionWarning,
+} from "./deploy-lockfile-selection.mjs";
 import { detectProjectConfigFile, warnProjectConfigSelectionOnce } from "./project-config-selection.mjs";
 import {
   canonicalizeBundleProjectConfig,
@@ -32,21 +36,6 @@ function readJson(path, readFileSyncImpl) {
   return JSON.parse(readFileSyncImpl(path, "utf8"));
 }
 
-function buildFilteredPackageJson(projectPkg, runtimeDeps) {
-  if (!Array.isArray(runtimeDeps)) return projectPkg;
-
-  const allDeps = { ...(projectPkg.dependencies || {}), ...(projectPkg.devDependencies || {}) };
-  const dependencies = {};
-  for (const dependency of runtimeDeps) {
-    if (allDeps[dependency]) dependencies[dependency] = allDeps[dependency];
-  }
-
-  return {
-    name: projectPkg.name || "gencow-app",
-    dependencies,
-  };
-}
-
 function copyOptionalBundleFiles({
   cwd,
   stagingDir,
@@ -132,12 +121,12 @@ export async function createDevCloudDeployBundle({
   if (!existsSyncImpl(functionsSource)) throw new Error(`Backend root dir not found: ${functionsSource}`);
 
   const projectPkg = readJson(resolvePathImpl(cwd, "package.json"), readFileSyncImpl);
-  const lockfileSelection = detectDeployLockfile({
+  const lockfileSelection = assertCanonicalDeployLockfile(detectDeployLockfile({
     cwd,
     packageManager: projectPkg.packageManager,
     existsSyncImpl,
     resolvePathImpl,
-  });
+  }));
   const lockfileWarning = formatDeployLockfileSelectionWarning(lockfileSelection);
   if (lockfileWarning) warnImpl(lockfileWarning);
   const projectConfigSelection = detectProjectConfigFile({ cwd, existsSyncImpl, resolvePathImpl });
@@ -160,7 +149,7 @@ export async function createDevCloudDeployBundle({
         })
       : null);
 
-  const { auditResult, auditMessage } = await collectRuntimeDependencyAudit({
+  const { auditMessage } = await collectRuntimeDependencyAudit({
     cwd,
     backendRootDir: bundleRootDir,
     warnImpl,
@@ -216,8 +205,7 @@ export async function createDevCloudDeployBundle({
     });
     if (cronManifest) filesToPack.push(CRON_MANIFEST_RELATIVE_PATH);
 
-    const filteredPackage = buildFilteredPackageJson(projectPkg, auditResult?.runtimeDeps);
-    writeFileSyncImpl(resolvePathImpl(stagingDir, "package.json"), JSON.stringify(filteredPackage, null, 2));
+    writeFileSyncImpl(resolvePathImpl(stagingDir, "package.json"), JSON.stringify(projectPkg, null, 2));
 
     copyOptionalBundleFiles({
       cwd,